Ajax Search Lite CVE-2026-111852

Exploitation requires only that the WPdreams Ajax Search Lite plugin (version n/a through 4.14.6) be installed and active on an internet-reachable WordPress site; the search endpoint is exposed to anonymous visitors by design, so no authentication, no special configuration, and no user interaction are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment: only sites running this specific plugin at or below 4.14.6 are affected. The 'Blind' nature limits data retrieval speed (inference-based rather than direct output), making exploitation noisier and more time-consuming but still fully automatable.

This is a genuinely high-priority vulnerability by its technical profile. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely exploitable, low-complexity, unauthenticated blind SQL injection - the most dangerous combination of access conditions, requiring no credentials or user interaction. The scope-change flag (S:C) and C:H drive the 9.3 score, reflecting that a compromised database can expose data beyond the immediate component. However, several real-world risk signals are MISSING from the input: there is NO EPSS probability score provided, NO CISA KEV listing, and NO indication of public exploit code. Per precision rules, exploitation status is 'no public exploit identified at time of analysis.' The I:N/A:L split and the 'Blind' qualifier are consistent - blind SQLi is primarily a confidentiality/data-exfiltration issue extracted inference-by-inference, which is slower and more detectable than error-based SQLi but fully automatable with standard tooling (e.g. sqlmap). Net assessment: a real priority for any site running this plugin due to unauthenticated network reach and the well-known ease of automating WordPress plugin SQLi, but the absence of EPSS/KEV/POC data means active-exploitation risk cannot be confirmed from the provided sources and should be verified against Patchstack and public exploit feeds.

A remote, unauthenticated attacker sends crafted requests to a public-facing WordPress site running Ajax Search Lite (<= 4.14.6), injecting SQL through a vulnerable search parameter. Because the flaw is blind, the attacker uses boolean- or time-based inference (easily automated with tools like sqlmap) to extract sensitive database contents such as user records and password hashes. No public exploit code is identified in the provided data, but the AV:N/AC:L/PR:N/UI:N profile makes exploitation straightforward if a working payload is developed.